Background Analysis

In February 2026, blockchain security firm Hexens disclosed a critical vulnerability in the Aptos blockchain Move Virtual Machine (Move VM). The bug originated from a cache handling defect in the Move VM, and when Hexens researchers simulated real-world attack paths using commodity hardware priced at just 3,000 dollars, they achieved an alarming success rate of nearly 90 percent. The vulnerability was responsibly disclosed to the Aptos team, who patched it within hours.